Data protection notice - University of Oulu stakeholders

Data controller

University of Oulu
Pentti Kaiterankatu 1
P. O. Box 8000, 90014 OULU

Units in charge of the processing:

The unit responsible for alumni, mentors, donors and other stakeholders personal information
University of Oulu, Communications, marketing and public affairs
Communications Director Marja Jokinen, e-mail address: viestinta(at)oulu.fi

Contact persons for more information
Alumni, mentors: Riitta Arffman
Donors: Kati Ketola
Stakeholders: Sakari Jussi-Pekka

The unit responsible for Kummi families’ personal information
University of Oulu, Academic Affairs, Director Vesa-Matti Sarenius, email: study(at)oulu.fi)

Contact person for more information
Kummi families: Ulla Alanko

The unit responsible for spouse network and programme for the spouses of international staff information
University of Oulu, Human Resources Services, Human Resources Director Jarmo Okkonen

Contact person for more information
University of Oulu international personnel spouse network and spouse programme information: Kaisu Kanstrén

Emails follow format firstname.lastname@oulu.fi

University Data Protection Officer: dpo(at)oulu.fi

Purpose of processing personal data and legal basis for processing personal data

We use your personal data to manage and develop University of Oulu external relations and partnerships. Personal data is specifically used for communications regarding the University of Oulu activities and events as well as for marketing purposes, event and concept management, and donor prospecting (excluding Kummi families and Spouse network and programme for the spouses of international staff of the University of Oulu).

In addition, for users logged into the University of Oulu alumni community platform, personal data will be processed regarding alumni networking, communication, and organisation of activities. The University of Oulu alumni community is a social communication channel that allows registered alumni to connect with the University and other alumni.

The legal basis for the processing of your personal data is legitimate interest as the significant bond between the university and the external stakeholders (alumni, donors, friends of the university, mentors, Kummi Families, spouses of international staff) has been built through studies and completing a degree, donation or other form of activities or cooperation. The processing of the data makes it possible for the university to manage the stakeholder relationship and maintain contact. Transferring donor data to the tax authorities: see paragraph Recipients or categories of recipients of personal data.

Regular sources of data

Alumni who have registered to the alumni community platform fill in and update the data either through logging into the platform, UniOulu Alumni mobile app or by asking for an update. In order to manage alumni relations, we update the study and diploma information from the University's student records system, as well as address information through the Population Information System.

Donor data is collected from the online donation form, deed of donation, and as for bank transfers to University of Oulu accounts, copies of statements of accounts. Data of other stakeholders is collected from registration or sign-up information. Contact person data for organisations providing the University of Oulu with traineeship positions is gathered from traineeship agreements and feedback forms. Address information may be updated through the Population Information System. We will add data on communications you have received from us and what events and activities you have participated in. We collect data of corporations from publicly available registers and registers that can be obtained against payment. We may collect personal data from publicly available registers.

Data of spouses of international staff is collected from the online registration form when registered for the spouse network and programme for the spouses of international staff. Data is also collected from sign-up information for events and activities.

Personal data to be processed

Alumni

• name, birthday or identity number, address, email, phone number
• information on studies: student ID number, faculty, degree, degree programme, other studies, year of commencement and graduation
• work information: employer, work address, job title, work phone number, start and end year
• use of University of Oulu alumni community platform
• communications between the alumn and the university
• potential other information from the alumn (for example, posts, comments, location information, social media channels, profile picture and language selection)
• categories (e.g. form of cooperation)
• subscriptions and interests (e.g. newsletter, mentoring)
• synchronising profile through LinkedIn
• electronic identification data (IP addresses, cookies)
• anonymized information about device usage (e.g. operating system, unique log in sessions, timestamps)

Donors

• name, identity number of date of birth, address, email, phone number
• information on the donation: sum, date and target of the donation
• communications between the donor and the university
• categories (e.g. form of cooperation)

Mentors

• name, email, social media channels, phone number, city of residence
• information on studies: field of studies, degree, year of graduation and other degrees
• employer, competencies
• communications between the mentor and the university
• potential other information from the mentor
• categories (e.g. form of cooperation)

Kummi Families

• name of the contact person, email, phone number
• communications between the contact person and the university
• potential other information given by the Kummi Family
• categories (e.g. form of cooperation)

Contact persons in organisations

• name, email, position, address of the organisation, business identity code, field, www address, social media channels
• communications between the contact person and the university
• categories (e.g. form of cooperation)

Other stakeholders

• name, identity number or date of birth, address, email and phone number
• communications between the stakeholder and the university
• categories (e.g. form of cooperation)
• traineeship supervisors and salary contact persons with contact information

Spouse of international staff

• name and email
• communications between the spouse and the university
• potential other information given by the spouse (for example, comments, feedback)
• categories (e.g. form of cooperation)
• subscriptions and interests (e.g. newsletter, events, training, counseling, mentoring)

These are examples of personal data that we handle. We do not collect all above mentioned data of all stakeholders but the personal data details depend on the forms of cooperation you are involved in with us.

Recipients or categories of recipients of personal data

Data can be passed on internally at the University of Oulu. Other than the University of Oulu, data can be handled by system and service providers authorised by the University of Oulu.

Name information can be passed on to alumni for causes related alumni activities, for example in order for alumni to organise an class reunion. Name data can be passed on to student organisations’ such as the student guilds’ persons in charge for alumni relations for causes related to developing alumni activities. The alumni community platform system provider (Hivebrite Solution) collects statistics on users, visits, and system usage, but before that the personal information of users has been anonymised. System statistics, visits, and usage data are only used after anonymisation, and their sole purpose is to improve and develop system performance.

Data transfers

Data shall not be transferred to third parties not mentioned in this listing. Data shall not be transferred outside the European Union or the European Economic Area. The University of Oulu has a legal obligation (TVL 98 a §) to transfer the information (donor and sum) on donations prescribed tax-deductible to Tax authorities.

Data storage time

Based on the significant bond between the stakeholders and the university, the personal data will be stored for the time being until the stakeholder requests for them to be deleted or until the university decides, storing is no longer necessary for the purposes of the processing.

Data subject rights

You have the following rights as a data subject:

• Right to access your data
• Right to have inaccurate data corrected (make sure to keep your contact information up to date)
• In certain situations, the right to have data erased ("right to be forgotten")
• In certain situations, the right to restriction of processing
• In certain situations, the right to object to processing
• In certain situations, the right to have data transferred from one system to another if the processing is based on consent or agreement and is performed automatically.

Please note that the applicability and scope of your above-mentioned rights will be specified on a case-by-case basis in accordance with the EU General Data Protection Regulation, depending on e.g. the grounds for processing the data, and that you do not have the above-mentioned rights in all cases.

If you have any questions about your rights, you can communicate with the University's Data Privacy Officer or the contact person of the responsible unit.

If you want to use the above-mentioned rights, please send a request to the University’s registry office: kirjaamo(at)oulu.fi, where you will get the necessary additional instructions.

Right of appeal to the supervisory authority

In addition to the rights mentioned above, you have the right to file a complaint about the processing of your personal data with the Office of the Data Protection Ombudsman as the supervisory authority. The contact details and opening hours can be found on the website of the Data Protection Ombudsman.

Obligation to provide the personal data

You have no statutory, contractual or any other obligation to provide us with your personal data.

No automated decision-making or processing the personal data for other purposes

We will not use your personal data for automated decision-making or for any other purposes than mentioned in this document.

General description of the technical and organisational protection measures

The University as the Data Controller uses appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against damage or loss of personal data.